Re: [PATCH 3/3] virtiofs: zero the reply region of the argument buffer

[sashiko-bot@kernel.org]

> copy_args_to_argbuf() allocates one buffer for the fixed in- and out-args
> and fills only the in-arg part.  The remainder is handed to the server as
> a device-writable buffer, and the server is under no obligation to write
> it: the used length it reports is its own claim and
> virtio_fs_verify_response() has nothing to cross-check it against.
> 
> A reply that declares its full length without filling the buffer makes
> copy_args_from_argbuf() copy the uninitialized remainder to the caller,
> so a server that fails partway through writing a reply returns stale heap
> contents from e.g. fuse_statfs() or fuse_getxattr() instead of an error.
> 
> Commit 5364d081125a ("virtiofs: validate fixed-output response length")
> covers the case where the declared length is short.  Zero the reply
> region so that the remaining case yields zeroes rather than whatever the
> allocator last held.  Only that region is zeroed; the in-arg part is
> overwritten by the copy below and the buffer can be as large as
> XATTR_SIZE_MAX.
> 
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-f0d6d4a3-f5df-4f72-ab09-802e5aab49a6
> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105150943.86650-1-mszeredi@redhat.com?part=3